If your kid is between 7 and 13, you already know what Roblox is. What most parents don't know is that it's also the largest behavioral research operation ever conducted on children, and that the lawyers currently "fixing" it are making the dataset bigger.

The scale is the story. In fiscal 2025 Roblox averaged 127 million daily active users who spent 124 billion hours on the platform. Their revenue was $4.9 billion and the company added 60 million daily users in a single year. Their own SEC filings state that "a large number of our users are under the age of 13", and when the age verification system rolled out in January 2026, 35% of verified daily users turned out to be under 13, with another 38% between 13 and 17. Only about 45% of users had completed verification at that point, so these are the kids whose parents let them point a camera at their face.

So nearly three quarters of the verified user base is minors. There is no comparable dataset on earth. Not in education, or medicine. Not anywhere.

What It Collects

The inventory comes from Roblox's own documents, which are more candid than you'd expect.

  • Account basics, birthdate, and purchase history down to the item.
  • Gameplay activity, meaning which experiences, how long, and with whom.
  • User-created content, which for a lot of kids is their actual creative work.
  • Geolocation inferred from IP address.
  • Every chat message, which is filtered, meaning it's read and processed by a machine before it reaches the other child.

Roblox's own FAQ for parents names the moments plainly: signup, purchases, chat messages.

There's also voice. If your kid is 13 or older and uses voice chat, Roblox's support documentation says it "may record voice audio anywhere on the platform," and lists the uses: moderator review of abuse reports, "training and evaluating automatic safety detection systems," and measuring overall platform safety. There's no option to use voice without being subject to recording. And when they say anywhere on the platform, it means anything it hears while your kid is using the app.

Read the retention purpose again, because it's the part nobody says out loud. Your kid's voice is training data. And here's a detail that should bug you: Roblox's privacy policy states it will not use private server voice recordings from EEA (European Economic Area) users for training and product improvement, and the same exists for Brazil. European and Brazilian children are excluded from the training set by law. American children are in it, because no American law says otherwise. Same platform but different continents and different rights.

One more thing on the chat filter. A 2026 independent study collected roughly two million real chat messages across four games and multiple age groups, and found that the moderation system filters isolated explicit terms but "grossly fails to detect unsafe content that emerges over a sequence of messages." The machine reads everything your child types and still misses the exact harm it exists to catch.

The Face Scan

This is the newest layer, and the one that should catch your attention.

Now, in order to use chat, a user has to complete facial age estimation. A camera, a selfie-style video, an on-screen prompt. The scan is processed by a third party called Persona, and the child follows the prompt without any explicit parental involvement in the moment. If the estimate is wrong (the margin of error runs about 1.4 years) a baby-faced 14 year old can be slotted into a younger age bracket and locked out of content. And parents have reported being locked out of their own parental controls in the confusion.

To be fair their Facial Media Capture Privacy Notice makes real promises. Persona deletes biometric data within 30 days unless the law requires holding it longer. Roblox says it never receives a copy. For selfie-only age estimation, both companies say the images are deleted after processing. Maybe it is, maybe it isn't.

Here's what the promises actually rest on. ID verification is a separate pipeline that retains more, including the government document and a facial geometry comparison. Persona's own policy notes that stored scan data may follow "specific instructions from customers about how long to keep it". So the 30-day promise is Roblox describing their contractual instructions to a vendor. The parent has no way to read that contract, no way to verify the deletion, and no legal right to confirmation. You are trusting a document about a deal you can't see, governing the biometric data of a child who wasn't asked and wasn't told.

Keep in mind this is meant to be a safety measure. That's its stated purpose. Age estimation exists because adults were impersonating minors on the platform. That harm was real and documented. The largest biometric collection from children in gaming history was deployed as a child safety feature.

The Lawsuits, And The Backwards Result

Here's what reframes everything.

Texas sued Roblox in November 2025, alleging child safety failures. Louisiana followed, and more state attorneys general piled on. In April 2026 Roblox settled with Alabama for $12.2 million, as well as Nevada and West Virginia, totaling $33 million. Other states' suits are still pending.

Let's look at the settlement terms rather than the numbers. Alabama's settlement requires Roblox to implement facial age estimation or government ID verification, and expanded behavioral monitoring for minor accounts.

What? A state attorney general punished a company for its handling of children's data by requiring it to collect more children's data. Face scans or government IDs, plus deeper monitoring of behavior. Every remedy in the settlement is an expansion of the file.

It's up to you to decide if the Attorneys General made the wrong call. The safety failures they were responding to involved children and real harm, and age assurance does address some of that. But like most government measures on social media, it's reactionary. And the remedy chosen was surveillance, and nobody in the process was representing the position that a child's data is a thing worth protecting. That position never has a seat at the table.

This is the pattern across much of what I write. Medical records, school files, cars, and more. Data collection begets data collection. The one option that's never on the menu is collecting less.

What This Means For Your Family

Start here: the safety story and the surveillance story are the same story. The chat filter that reads every message, the voice recordings, the face scan, the behavioral monitoring — each one is justified individually, but your child's experience of them is identical: a system watching everything they do, run by a company whose revenue depends on how long they keep doing it. Your kid can't tell the guard from the researcher, and at the architecture level, there isn't a difference.

That would be easier to accept if the watching actually worked. It doesn't, not fully. Remember the study I mentioned above. Reviewing 2 million real chat messages found the filter misses the exact harm it was designed to catch — not occasional messages, but patterns of harm that develop across a sequence. You're not trading privacy for safety in a clean exchange. You're trading privacy for a safety system that catches the easy stuff while the harder harm happens in the gaps. Whether that trade is worth it is a question most parents have never been handed the terms to answer.

And the legal process meant to fix this is running in the wrong direction. The lawsuits aren't shrinking Roblox's data — they're growing it, on a schedule set by attorneys general who leave office, against a company that will still hold the data in 2044, when your 9 year-old is applying for jobs and a mortgage. The face scan may be deleted in 30 days, if the contract says so but the behavioral profile has no published clock at all.

Your child will spend their entire adolescence inside systems like this one. Roblox is the template, not the exception. The kids currently on it are the first generation to grow up with engagement optimization aimed at them from age seven. What they normalize now is what every platform gets to treat as consent later.

Roblox is a system built to watch kids learn to play, build, and be social, with no off switch and no published clock. The game they're playing is the least interesting thing happening on that screen.